From patchwork Mon Aug 7 22:00:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 13345143 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id D13AFC001DE for ; Mon, 7 Aug 2023 22:03:47 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6D317940008; Mon, 7 Aug 2023 18:03:47 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 634908D0001; Mon, 7 Aug 2023 18:03:47 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4D5BA940008; Mon, 7 Aug 2023 18:03:47 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 3AD9D8D0001 for ; Mon, 7 Aug 2023 18:03:47 -0400 (EDT) Received: from smtpin13.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 0977C120BFA for ; Mon, 7 Aug 2023 22:03:47 +0000 (UTC) X-FDA: 81098686494.13.408D854 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf17.hostedemail.com (Postfix) with ESMTP id 37E4E40018 for ; Mon, 7 Aug 2023 22:03:44 +0000 (UTC) Authentication-Results: imf17.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=gHpCqYNG; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf17.hostedemail.com: domain of broonie@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=broonie@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1691445825; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=bAEInLM39Sy/hOSS3gc0MsZfXLP1bvbW2+0n9AI/9oc=; b=o9TMIA8hOIrracMUByRTCzUvijoDQc4HF4kpzVHTqxmlBdG9Hf82mJFZWscA2KTyWw6CDd XdixjiJVUf0+R2UkjfUWOdVJD06w0pHoX2v0dR9E1KjD4geEPsZ2rN7xZ6Bxm/iq0Cv2ou RZRSBhY/4ZigizgmIWt0hieZovrGW0s= ARC-Authentication-Results: i=1; imf17.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=gHpCqYNG; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf17.hostedemail.com: domain of broonie@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=broonie@kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1691445825; a=rsa-sha256; cv=none; b=6+Q8Jg9JIfGQ6hSKcya2Y1HBBGMGAEnM5yQSFmP4XOrrfIT0GO8qr/zcRGgR8OIla4ErC5 WIVjvMGs3KT3MvKIEY/ldgp4r5NKHueDTz03wfnNv0pqFlmh3EE8+cc4rLMr5azjEzSBdA DC/ZRWFsPC1QgMDnGd3tjddxBTcwAak= Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6CBC9622A1; Mon, 7 Aug 2023 22:03:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1E668C433C8; Mon, 7 Aug 2023 22:03:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1691445823; bh=I1+SuKJuT5iazgzZ0wCXVNUOE3JpgB2Z9BDX1mM3nWU=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=gHpCqYNG4awhvx9sqcOlbeWAYnzPJQSc37UIauZOMkm19o39gat5h0WxJWTfJbXbM OAtAhLwxUSrOzSEFLvmZmLVgARyU66Joc0n8yvEHKcPZwZU3Ypniwd+Kx1Xi1uapyT yPMi+fpkBECD6/5OndwmZNLOC5bDADsAS4f/sSYBN5fELtgjZNQcdJWFN0Us6GIHx7 luc4jMODl9scAvZO54tnLr/Oz63fwdFjWp7sxJjOy/+xJyvv3xBuzh3YQZaXd4mnE5 ULZgz6KkvfrY6xVmZtmDr4Ohd5UCCq9KuhR8C8Q6erANW1PSuQ8WGMmWmu2bLbRNen a3M82+t+TH/Lw== From: Mark Brown Date: Mon, 07 Aug 2023 23:00:26 +0100 Subject: [PATCH v4 21/36] arm64/mm: Implement map_shadow_stack() MIME-Version: 1.0 Message-Id: <20230807-arm64-gcs-v4-21-68cfa37f9069@kernel.org> References: <20230807-arm64-gcs-v4-0-68cfa37f9069@kernel.org> In-Reply-To: <20230807-arm64-gcs-v4-0-68cfa37f9069@kernel.org> To: Catalin Marinas , Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Kees Cook , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy Cc: "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, Mark Brown X-Mailer: b4 0.13-dev-034f2 X-Developer-Signature: v=1; a=openpgp-sha256; l=4897; i=broonie@kernel.org; h=from:subject:message-id; bh=I1+SuKJuT5iazgzZ0wCXVNUOE3JpgB2Z9BDX1mM3nWU=; b=owEBbQGS/pANAwAKASTWi3JdVIfQAcsmYgBk0WmomIt//HAc9Py9yC1PS0uokFzGNdVQXuKQ/8fg AuDdVSGJATMEAAEKAB0WIQSt5miqZ1cYtZ/in+ok1otyXVSH0AUCZNFpqAAKCRAk1otyXVSH0CBkB/ 4g/60yBcwBTiQKu1O+mOr+XUawY9DnnSHL9z8Cg1frClnMiULipYsYioyurJfUd4A/3ZbgjdSBKLlA zoPSHwJJ3CAAF9NHg36bAgUybQuV1JdlqDc45CSNZ9/PQwTBCSBcnF5IOjMekhOwyWMW5sd70AHf3Z wrGFG80rcqjFiCxTectDKdk5HybgNXsob55hWlM4hMHsPFLhzTVXURlOMjowTUCaom8QdFQ4aYuGXV Hwroyl5yDT/ljDNavh/EpRMZnPmNCwEec17wb2E4tIeaWv8mnE/z4WuTe4WgmdDQDHf80f5C/91Ams M4yzYYosCAFShlGXXhjJohRU1sNEF4 X-Developer-Key: i=broonie@kernel.org; a=openpgp; fpr=3F2568AAC26998F9E813A1C5C3F436CA30F5D8EB X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 37E4E40018 X-Stat-Signature: 53dettyg46kf4krp8jrddnqpdnojiexo X-HE-Tag: 1691445824-740366 X-HE-Meta: U2FsdGVkX1/vwnZgWI7MJeKEZgEZHX0IrZ66YuNZJMVcNzawCIWiyzfobbJl+MUgfZEZK3l7seDuWIsh0J+zp05oKu0DFf8ZZldaWo4xN9ATPQpS8dMmSOWiBQN4M68HrB0n9G72ccb06oKhJ2Oqn3eZZ090fmPa+2pwfCaNQNlgpF+Mg+y7W8tCHApQghkdjv85DD/5eP1Rs0t1ayKbTbzkW/EEub6iTdz8Xdnh7u+Kp0TkdmVMn5S2MhgaCTZ1C3ThSeUOHP1usuyujoky+lKWCNzTcVSEhc0sFUbsun6vFmK8tbQgyR0W5dSnh3AWrg/pcg6xxcA1iJCWqIhA1sbslsXfPh6wojl7M/WzPYjpTBKjGEp8Fwm7ySkDDQMyBndTArHpKbWRZOA8Lr6f/v5yJKU6UL78aRwCbOLN7Fpwd1BXt2962ZhrWQE+G+9fvOFzXVxXj0Mq+Ftjh0mmA4930xtZ4OEHD5FurclSzAha13BSzt6UfBIgn60czvYJL7L8qaOtE0NZnxOKEbkw7uHTbf9nhknC9tMydv2w7wJ3zc6TUGQ6JkV0DELOKcMH1RGMa0VCAVBvsyFxaHYIjOSA8rr9876Tdi3DSjw6ulDV2tB3UdKaNHhwGoMWU0IoajVsTnvC2qVdMQBpHaZ/1XBXBrFblGa4o3pgXr4ZTNgkF1f7nUKbtxQC+GI19zWeYj9SHRUWu2tfzmo5wktNWlpnUM/79AwfVi4It/DauMXWAY/x9KP830NMt5pLwBNpb/k9hrmFp656fiLV+bKOkdSxOwXsBmyUeuF0jBrmhOFBftETzDi0TmQBP7AxhcHPE3B2JS1WmL18NL69qLuHonOwuj7CIXYjquEY4cpyKTKhwcIi9yC2y+Kfwc6J+uxL5Ut0K5ig6D9QuaUnGKoN3hR4p4cnkYXM1WMj85MPf7heaNUf5Tasri42O3dyZs4FY5QBavcyELQpA6tZ5xf 8oxceHDr N5lBUPWucxt2mqqEI3Xstzm8Men/VmeccCGd9eX+q1BBjM8xQ9oErNbcmvVjxvnGnkh7Esjs5gCwS1CSmIi23bngSAjuHNpiPgiP+TcxLdSM+iipusVYkYOSF3ORSUCTKHuR241Y/pYy1hhlApwRbzvyn9LPEQaNVb9VX4JCslg/GMr6AIjhnoHmozsK2z/3FWidGXgSDHrcN9k4NOff9zSwCggyztUVcO9rWM+IyJCYg5cFLbEgfcbdBoy7AdJ6rqs7SiJZSm5Uq2TpHrxnEtTT1xW+y3zOtS1DMzVpzysQv8qvRCojTY7Co4dE7aHWrgmV1PsgBqa9eL+SSkL2f62He+55fwdsCIMKDf3C9z41PS2IzJuhoIzKkUUUHMET9tFnUnk5v/xcRhCQAkJ3qN+Wuabp6g8NNWYO8IQD03b88U6S3z1P8DJOZO7mv187jATIkmY9+oUiXJeHG6OVYXBjnkg== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for guarded control stacks since they lead to windows where memory is allocated but not yet protected or stacks which are not properly and safely initialised. Instead a new syscall map_shadow_stack() has been defined which allocates and initialises a shadow stack page. Implement this for arm64. Two flags are provided, allowing applications to request that the stack be initialised with a valid cap token at the top of the stack and optionally also an end of stack marker above that. We support requesting an end of stack marker alone but since this is a NULL pointer it is indistinguishable from not initialising anything by itself. Since the x86 code has not yet been rebased to v6.5-rc1 this includes the architecture neutral parts of Rick Edgecmbe's "x86/shstk: Introduce map_shadow_stack syscall". Signed-off-by: Mark Brown --- arch/arm64/mm/gcs.c | 58 ++++++++++++++++++++++++++++++++++++++- include/linux/syscalls.h | 1 + include/uapi/asm-generic/unistd.h | 5 +++- kernel/sys_ni.c | 1 + 4 files changed, 63 insertions(+), 2 deletions(-) diff --git a/arch/arm64/mm/gcs.c b/arch/arm64/mm/gcs.c index 64c9f9a85925..b41700d6695e 100644 --- a/arch/arm64/mm/gcs.c +++ b/arch/arm64/mm/gcs.c @@ -52,7 +52,6 @@ unsigned long gcs_alloc_thread_stack(struct task_struct *tsk, return 0; size = gcs_size(size); - addr = alloc_gcs(0, size, 0, 0); if (IS_ERR_VALUE(addr)) return addr; @@ -64,6 +63,63 @@ unsigned long gcs_alloc_thread_stack(struct task_struct *tsk, return addr; } +SYSCALL_DEFINE3(map_shadow_stack, unsigned long, addr, unsigned long, size, unsigned int, flags) +{ + unsigned long alloc_size; + unsigned long __user *cap_ptr; + unsigned long cap_val; + int ret, cap_offset; + + if (!system_supports_gcs()) + return -EOPNOTSUPP; + + if (flags & ~(SHADOW_STACK_SET_TOKEN | SHADOW_STACK_SET_MARKER)) + return -EINVAL; + + if (addr % 8) + return -EINVAL; + + if (size == 8 || size % 8) + return -EINVAL; + + /* + * An overflow would result in attempting to write the restore token + * to the wrong location. Not catastrophic, but just return the right + * error code and block it. + */ + alloc_size = PAGE_ALIGN(size); + if (alloc_size < size) + return -EOVERFLOW; + + addr = alloc_gcs(addr, alloc_size, 0, false); + if (IS_ERR_VALUE(addr)) + return addr; + + /* + * Put a cap token at the end of the allocated region so it + * can be switched to. + */ + if (flags & SHADOW_STACK_SET_TOKEN) { + /* Leave an extra empty frame as a top of stack marker? */ + if (flags & SHADOW_STACK_SET_MARKER) + cap_offset = 2; + else + cap_offset = 1; + + cap_ptr = (unsigned long __user *)(addr + size - + (cap_offset * sizeof(unsigned long))); + cap_val = GCS_CAP(cap_ptr); + + ret = copy_to_user_gcs(cap_ptr, &cap_val, 1); + if (ret != 0) { + vm_munmap(addr, size); + return -EFAULT; + } + } + + return addr; +} + /* * Apply the GCS mode configured for the specified task to the * hardware. diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h index 03e3d0121d5e..7f6dc0988197 100644 --- a/include/linux/syscalls.h +++ b/include/linux/syscalls.h @@ -953,6 +953,7 @@ asmlinkage long sys_set_mempolicy_home_node(unsigned long start, unsigned long l asmlinkage long sys_cachestat(unsigned int fd, struct cachestat_range __user *cstat_range, struct cachestat __user *cstat, unsigned int flags); +asmlinkage long sys_map_shadow_stack(unsigned long addr, unsigned long size, unsigned int flags); /* * Architecture-specific system calls diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h index fd6c1cb585db..38885a795ea6 100644 --- a/include/uapi/asm-generic/unistd.h +++ b/include/uapi/asm-generic/unistd.h @@ -820,8 +820,11 @@ __SYSCALL(__NR_set_mempolicy_home_node, sys_set_mempolicy_home_node) #define __NR_cachestat 451 __SYSCALL(__NR_cachestat, sys_cachestat) +#define __NR_map_shadow_stack 452 +__SYSCALL(__NR_map_shadow_stack, sys_map_shadow_stack) + #undef __NR_syscalls -#define __NR_syscalls 452 +#define __NR_syscalls 453 /* * 32 bit systems traditionally used different diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c index 781de7cc6a4e..e137c1385c56 100644 --- a/kernel/sys_ni.c +++ b/kernel/sys_ni.c @@ -274,6 +274,7 @@ COND_SYSCALL(vm86old); COND_SYSCALL(modify_ldt); COND_SYSCALL(vm86); COND_SYSCALL(kexec_file_load); +COND_SYSCALL(map_shadow_stack); /* s390 */ COND_SYSCALL(s390_pci_mmio_read);